Skip to main content

DUSD Peg Stability Module

Overview​

The DUSD/USDC Peg Stability Module (PSM) is a specialized contract that lets users swap between DUSD and USDC at a predefined rate. It provides an additional, tightly risk-limited path to mint and burn DUSD directly against USDC, alongside the existing DUSD minting/borrowing flows.

At a high level, the PSM:

  • Holds USDC on one side and DUSD on the other
  • Mints new DUSD when users swap USDC → DUSD
  • Burns DUSD when users swap DUSD → USDC
  • Charges a small fee on both directions, which is routed to the protocol’s fee collector

A key design goal of the PSM is to provide reliable, deep DUSD liquidity to repay debt and perform liquidations. It helps ensure that debt repayers and liquidators can always source DUSD to close positions, shielding the protocol from insolvency when external DUSD liquidity is limited or stressed.

Fixed price​

The PSM uses a simple fixed price between DUSD and USDC:

1 DUSD = 1 USDC (before fees)

This price does not depend on lending or liquidation oracles and can be updated via governance if the DAO decides to change it in the future. Within the protocol, DUSD is treated as worth 1 USD for risk calculations; the PSM is the contract that makes this assumption explicit when trading against USDC.

Fees​

Swaps through the public PSM pay a small percentage fee in both directions:

  • USDC → DUSD: 0.20%
  • DUSD → USDC: 0.20%

A user swapping USDC to DUSD receives slightly less DUSD than a pure 1:1 swap, and a user swapping DUSD to USDC receives slightly less USDC than the nominal amount. All fees accrue to the protocol’s fee collector contract and ultimately support ALTO staker rewards. The fee compensates the protocol for offering a predictable, protocol-owned liquidity source and discourages zero-cost cycling through the PSM.

Exposure cap and minting limits​

To keep the protocol’s USDC exposure within a controlled range, the PSM currently has a maximum USDC capacity of 5,000,000 USDC. The module will refuse swaps that would push its USDC balance above this limit.

On the DUSD side, the PSM has permission to mint new DUSD when users bring USDC into the module and to burn DUSD when users bring it back in exchange for USDC. Because the PSM can only accumulate USDC up to the configured cap, the total amount of USDC-backed DUSD that can be created through this path is also bounded.

The end result is straightforward: USDC entering the PSM mints new DUSD, DUSD entering the PSM burns that DUSD and releases USDC, and every DUSD minted via the PSM is fully backed by USDC held in the module, with a clear upper limit on total USDC exposure.

User experience in the Alto app​

In the Alto app, the PSM is presented as a simple swap interface between USDC and DUSD. Users select the direction of the swap, enter an amount, and see how much they will receive after fees.

  • Swapping USDC to DUSD mints new DUSD against the supplied USDC and is available as long as the PSM has not reached its USDC cap.
  • Swapping DUSD to USDC burns the supplied DUSD and releases USDC from the module’s reserves, and is available as long as there is sufficient USDC in the PSM.

The interface shows the output amount, the fee applied, and whether the swap is currently executable given the module’s balances and limits. Users do not need to open or manage a lending position to use this; the PSM behaves like a predictable, protocol-owned liquidity pool between DUSD and USDC.

How the PSM supports the DUSD peg​

The PSM is one of the main tools used to keep DUSD trading close to $1, working alongside external DEX liquidity such as DUSD/USDC pools.

  • When DUSD trades below $1 on external markets, arbitrageurs can buy discounted DUSD from a DEX and swap it back to USDC via the PSM. Over time, these flows burn DUSD in the PSM, reduce its USDC reserves, and push the market price of DUSD back up toward $1.
  • When DUSD trades above $1, arbitrageurs can use USDC to mint DUSD via the PSM at the fixed 1:1 rate, and then sell that DUSD into the external market where it is more expensive. This increases DUSD supply, increases USDC held by the PSM, and pushes DUSD’s external price back down toward $1.

Because the PSM is capped and charges a fee, it acts as a strong but bounded stabilizer for the peg rather than an unlimited, free redemption facility.

Debt repayment, liquidations, and protocol safety​

Beyond peg stability, the PSM is explicitly designed as a backstop liquidity source for DUSD in the context of debt repayment and liquidations.

For regular users, this means that if they have DUSD-denominated debt, they can obtain DUSD in a predictable way: swap USDC for DUSD via the PSM, then use that DUSD to repay their position. They do not have to rely on potentially thin or volatile external DUSD markets as long as the PSM still has capacity.

For liquidators, the PSM provides a reliable way to source DUSD to repay under-collateralized positions. Liquidators can swap USDC to DUSD in the PSM, repay the debt in the protocol, and seize collateral, even during periods when DUSD liquidity on external venues is stressed.

This design makes DUSD reliably available even when external markets are stressed. Because DUSD can always be sourced via the PSM (within its capacity), debt can be repaid and liquidations can proceed, which materially reduces the risk of the protocol becoming undercollateralized due to lack of DUSD liquidity.

Governance, roles, and safety controls​

The PSM follows Alto’s standard governance and safety patterns.

The admin of the PSM and its strategy contracts is the timelock multicall contract, which is itself controlled by the Owner Multisig. All key parameters (USDC exposure cap, price strategy, fee strategy) and ownership of related contracts are managed through this timelock.

Fees collected by the PSM are sent to the protocol’s fee collector contract, also owned by the Owner Multisig via a TimelockController. This contract aggregates revenue from the PSM and other protocol components, and those funds are then distributed to ALTO stakers according to the staking and rewards logic.

A Pauser/Freezer Multisig can pause swapping in emergencies or abnormal conditions (for example, issues with USDC or a critical bug). When swaps are frozen, neither direction (USDC → DUSD nor DUSD → USDC) is available until the role holder unfreezes the module through the appropriate governance process.

All important parameter changes are subject to a timelock so the community and risk contributors can review them before they take effect.

Permissioned PSM vs public PSM​

Alongside the user-facing PSM, Alto also deploys a permissioned DUSD/USDC PSM intended solely for treasury and liquidity management. This permissioned PSM is only accessible to whitelisted addresses such as the treasury multisig, is not integrated in the public UI, and is not meant as a public arbitrage or user tool.

It is primarily used to seed and rebalance protocol-owned DUSD/USDC liquidity on DEXs and to adjust the treasury’s composition between DUSD and USDC. The public PSM focuses on user swaps, peg stability, and debt-repayment liquidity, with clearly defined caps and fees. The permissioned PSM focuses on internal treasury operations, with parameters set by governance based on treasury and liquidity needs rather than public user flows.

Parameter summary (public DUSD/USDC PSM)​

  • Assets: DUSD and USDC
  • Maximum USDC exposure: 5,000,000 USDC
  • Fixed swap rate: 1 DUSD : 1 USDC (before fees)
  • Swap fee USDC → DUSD: 0.20%
  • Swap fee DUSD → USDC: 0.20%
  • Admin: timelocked admin (multisig / multicall)
  • Fee recipient: protocol fee collector
  • Special roles: swap freezer (pauser/freezer multisig)